Computers are vulnerable to malicious computer code attacks, such as worms, viruses and Trojan horses. As used herein, “malicious computer code” is any code that enters a computer without an authorized user's knowledge and/or without an authorized user's consent. Malicious computer code attacks attempt to transmit malicious code to a target computer, and then run the malicious code on that target computer.
Services are special programs that run on every Windows NTx computer. As used herein, a Windows NTx computer is any computing device running an operating system based on Microsoft Windows NT® code (e.g. Windows NT 3.x, Windows NT 4.x, Windows 2000, Windows XP, Windows 2003), including any future developed versions, extensions or equivalents thereof. Some services are provided by Microsoft, and others can be written and/or added by users, for example system administrators.
The Windows Service Control Manager is executed by Windows every time the system boots. The Control Manager automatically starts registered services before user logon, and before the Windows shell is started.
Registering and controlling a service on a Windows NTx computer requires a user to have sufficient security privileges. If the user has adequate privileges, then he or she can install a new service, register a new service, configure an existing service, terminate an existing service or suspend an existing service.
A service can be installed as an executable image or as a dynamic link library (DLL) that will run within the context of a service container process. Windows provides such service container processes, some of which contain system provided services, and as such are trusted processes.
Services present various security risks. Because they are automatically started before user logon or the Windows shell, a service could maliciously modify the logon process or the shell itself. Also, any application with sufficient right security privileges can terminate or modify crucial services, e.g., system services or anti-virus services. Furthermore, malicious code can be loaded as a DDL provided service into a trusted container, and thereby gain access to important system resources to which the trusted container has access.
It has been a common trend for malicious code to install itself as a service to gain control of a computer. Recall that services are installed and executed every time the system is booted. A Windows virus could simply wait until it is running within the context of a user who has enough privilege to install or configure a service, and then install a copy of itself as a service, and/or take control of an existing service.
Many mission critical applications are installed as services. Being able to define and execute a system wide security policy against malicious code that utilizes services as a method of infecting host machines is very important. The Microsoft provided library to manage services (registration, configuration, control, deletion, etc.) is very powerful. However, it does not provide the ability to solve the problems described above.
What is needed are methods, computer readable media and systems that allow the monitoring and control of services, such that a Windows NTx computer can be secured against service associated vulnerabilities.